Continual Learning without Silent Change in Medication-Support Systems

Medication-support systems may change after implementation because patient populations, clinical practices, data pipelines, coding conventions, medicine knowledge, model parameters, interfaces, and user responses evolve. Such change becomes unsafe to govern when it is not visible, version-linked, investigated, or subjected to evidence proportionate to its possible consequences. This article develops a proposed continual-learning control architecture for medication-support systems. It distinguishes continual learning from automatic production updating and defines silent change as a potentially consequential alteration in data, semantics, model behaviour, workflow position, human use, or decision effects that occurs without a contemporaneous and accountable assessment of whether requalification is required. The proposed architecture separates a locked operational plane from an isolated candidate-learning plane. Its principal components are an intended-use and change contract, multidimensional monitoring, change-event classification, an immutable version and evidence ledger, risk-proportionate requalification, staged release, rollback, suspension, and retirement. A no-silent-promotion boundary prevents a candidate version from replacing the operational version solely because retraining or automated updating has occurred. Evaluation must extend beyond discrimination to calibration, medication-task performance, workflow effects, human reliance, medication-safety signals, subgroup equity, traceability, and organizational readiness. Validation would require retrospective, external, prospective, human-factor, implementation, and post-release evidence matched to the system’s intended use and potential medication harm. The architecture does not establish clinical effectiveness, regulatory conformity, universal thresholds, or deployment readiness. Its original contribution is an integrated governance structure through which continual learning may remain technically possible while operational change remains visible, reviewable, reversible, and professionally accountable.